Security & Compliance

All traffic is served over TLS 1.3. The application sends HSTS (two years, including subdomains, preload-eligible), an enforced Content-Security-Policy, X-Frame-Options: DENY plus frame-ancestors ‘none’, nosniff, a strict-origin referrer policy, and a Permissions-Policy that denies camera, microphone, geolocation and topics. These are response headers — you can verify every one of them against the live site before you believe this page.

The public API is served through an explicit path allowlist at the edge: a route that is not on the list is not reachable from the internet, and administrative endpoints are not on the list. Outbound webhooks are HMAC-signed so your receiver can verify that a delivery came from us and was not altered in transit. The public lead forms are screened before anything is forwarded — a honeypot field, a time-to-submit check, and per-IP throttling.

Every search, dossier generation and download is timestamped and logged against the account that performed it, including through the API. That record is what lets a reviewer reconstruct what was checked on a deal and when.

The limit, stated plainly: attribution today is per account, not per analyst, because an account is currently a single login (see below). A firm sharing one login gets a complete record of what the firm did and no way to tell which analyst did it.

The property intelligence is public, read-only government data — the same corpus for every customer, so there is no per-customer property data to leak between accounts. Private account state — search and download history, API keys, watchlists, branding — is access-controlled and scoped to the account that owns it.

Access to production systems is restricted to PearlAudit personnel on a need-to-know basis. We do not grant third-party vendors direct access to your account data.

Account information and usage logs are retained for the life of the account and for up to three years after closure, to support billing disputes, legal compliance and audit requirements. You may request deletion of your account and its data at any time; we process deletion requests within 30 days, subject to legal retention obligations. Full detail is in the privacy policy.

We use a deliberately small number of service providers, each under contract and permitted to use data only to perform services for us: authentication and session management, product analytics, payment processing, and — only when you order a printed briefing — physical mail delivery, which receives the delivery address you supply and nothing else. Municipal and federal data sources receive no personal data at all; we read public records from them.

We publish these by function rather than by vendor name. The named list, with roles and locations, goes to you as part of a security review or under NDA — ask and you will have it.

We do not use Google Analytics, Meta Pixel, or any third-party advertising tracker, and we do not sell your data.

If you believe you have found a security issue, email help@getpearlaudit.com with enough detail to reproduce it. We will acknowledge you, we will not pursue anyone who reports in good faith and does not exfiltrate data or degrade the service for others, and we will tell you when it is fixed.